Passport control is after landing and before you exit TBIT. Once you exit TBIT, just turn left and walk to T3, you clear security there. Then once airside you can roam between the terminals, including T3 and TBIT.

Despite folks trying to sell the AF lounge, the DL Skyclub is much closer to the gates, its a brand new space and unless you want edible cheese to the extent that is possible in the US, minimal difference with the AF lounge F&B options and it has competent bartenders.